Azure Identity SDK for Rust

Authentication library for Azure SDK clients using Microsoft Entra ID (formerly Azure AD).

The examples below require a reviewed compatible crate set and replacement of every resource placeholder. Do not use production data for demonstration writes.

Installation

cargo add azure_identity@=1.0.0 azure_core@=1.1.0

Environment Variables

# Service Principal (for production/CI)
export AZURE_TENANT_ID="<your-tenant-id>"
export AZURE_CLIENT_ID="<your-client-id>"
: "${AZURE_CLIENT_SECRET:?Inject through the approved host or CI secret manager}"
export AZURE_CLIENT_SECRET

# User-assigned Managed Identity (optional)
export AZURE_CLIENT_ID="<managed-identity-client-id>"

DeveloperToolsCredential

The recommended credential for local development. Tries developer tools in order (Azure CLI, Azure Developer CLI):

use azure_identity::DeveloperToolsCredential;
use azure_security_keyvault_secrets::SecretClient;

let credential = DeveloperToolsCredential::new(None)?;
let client = SecretClient::new(
    "https://my-vault.vault.azure.net/",
    credential.clone(),
    None,
)?;

Credential Chain Order

Credential Types

ManagedIdentityCredential

For Azure-hosted resources:

use azure_identity::{ManagedIdentityCredential, ManagedIdentityCredentialOptions, UserAssignedId};

// System-assigned managed identity
let credential = ManagedIdentityCredential::new(None)?;

// User-assigned managed identity
let options = ManagedIdentityCredentialOptions {
    user_assigned_id: Some(UserAssignedId::ClientId("<user-assigned-mi-client-id>".into())),
    ..Default::default()
};
let credential = ManagedIdentityCredential::new(Some(options))?;

ClientSecretCredential

For service principal with secret:

use azure_identity::ClientSecretCredential;

let credential = ClientSecretCredential::new(
    "<tenant-id>".into(),
    "<client-id>".into(),
    "<client-secret>".into(),
    None,
)?;

Best Practices

1. Use `DeveloperToolsCredential` for local dev — automatically picks up Azure CLI
2. Use `ManagedIdentityCredential` in production — no secrets to manage
3. Clone credentials — credentials are Arc-wrapped and cheap to clone
4. Reuse credential instances — same credential can be used with multiple clients
5. Provide the async runtime — add Tokio with the features required by your application; do not assume a crate-specific tokio feature exists

The reviewed example set uses azure_identity 1.0.0 and compatible Azure core/credential crates. Record and commit Cargo.lock; source/API review is not a compiler or live-service test.

Reference Links

When to Use

Use when choosing or configuring Entra ID credentials for Rust Azure SDK clients: local developer tools, managed/workload identity or a reviewed service principal.

Limitations

• Examples are fragments inside async application code, with compatible pinned Azure crates and the required Tokio/Serde/Futures dependencies; verify the selected version’s API before use. They were reviewed against official source/reference, not compiled or run against a cloud account here.
• Use an authorized tenant, resource and identity with least privilege. Writes, overwrites, deletes, backup retrieval and account changes require the corresponding scope; cleanup may remove only explicitly identified disposable resources. Bound requests, retries and downloaded bytes, and do not log payloads, credentials or secret values.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.